SiYuan through version 3.7.3 stores block metadata fields—name, alias, and memo—directly into the HTML of an autocomplete hint popup that appears when a user types '(('. The code responsible for building this popup fails to escape the metadata, which allows an attacker who can set these fields to embed a self‑executing payload such as <img src=x onerror=…>. When the victim opens the application and triggers the hint popup, the injected script runs automatically. Because the underlying Electron environment enables nodeIntegration, disables contextIsolation, and lacks a Content Security Policy, the script can leverage Node’s child_process module to execute arbitrary operating‑system commands, effectively turning the XSS into a remote‑code‑execution flaw.

The vulnerability is present in the Siyuan Note application, as distributed by siyuan-note:siyuan, for all releases up to and including 3.7.3. Users of version 3.7.3 or earlier should upgrade to the patched release before it is widely deployed.

The flaw carries a CVSS score of 9.3, indicating a high likelihood of severe impact. EPSS score of < 1% indicates a low probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack path requires the attacker to influence block metadata that a victim later opens with Siyuan; the victim must then edit text that triggers the hint popup. Given the absence of a remote trigger, the hazard is primarily local but could be leveraged through social engineering or malicious file sharing. Successful exploitation would grant the attacker full control over the victim’s host system.